MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07f008e9ebfb33b2ef8a7f9dcf1f27bed1687359eb321044db47f9ebf70ed129. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	07f008e9ebfb33b2ef8a7f9dcf1f27bed1687359eb321044db47f9ebf70ed129
SHA3-384 hash:	8635b2c20919936913c46cf48cf016a41743ca4f2bae18342b3304e1735e2c0f5bb872f68ab7c405bbcd4f2acbecb335
SHA1 hash:	682869d308b976aab3fa687385fe389676a8ff76
MD5 hash:	547b2aaf0bf80f846e2f0c1ea166ed94
humanhash:	may-solar-california-mobile
File name:	OutlastTrials.exe
Download:	download sample
Signature	FrostStealer Alert Create hunting rule
File size:	95'714'544 bytes
First seen:	2026-04-20 20:58:10 UTC
Last seen:	2026-04-21 09:48:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9eba512b03d8cac8a6c4424e25e9f06e (7 x FrostStealer, 2 x MythStealer, 1 x CoinMiner)
ssdeep	1572864:lVDG5MiP2aVxUXx2XTnpOuQ6VVJnBgt1F+6DudYaux4:lVDG5NVyx2jnpA6xnBgt1F+dOC
TLSH	T1EF28E01663E112A6D577D138C79BA203EB72B40713309BDF729C03652F63AE45EBA760
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	3182a6a4a8e2369d (1 x FrostStealer)
Reporter	burger
Tags:	exe FrostStealer

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

168

Origin country :

DE

Vendor Threat Intelligence

ACCE MurmurHash3_128x64

Details

Link:

https://research.acce.ciphertechsolutions.com/results/3c5ef033-a186-4be1-9c80-892a93b1b2b9/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

OutlastTrials.exe

Verdict:

Malicious activity

Analysis date:

2026-04-20 20:58:14 UTC

Tags:

nodejs openssl tool

Link:

https://app.any.run/tasks/bb96d43a-9383-4ae2-9a01-52586abf5aaa

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Unknown

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69e69325f68adfe1003c0173

Tags:

xtreme shell sage

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Running batch commands

Creating a process with a hidden window

Launching a process

DNS request

Creating a file in the %temp% subdirectories

Connection attempt

Creating a file

FileScan.io

Gathering data

Hybrid Analysis Trojan.Win64.GenPsw

Verdict:

Malicious

Labled as:

Trojan.Win64.GenPsw

Link:

https://www.hybrid-analysis.com/sample/07f008e9ebfb33b2ef8a7f9dcf1f27bed1687359eb321044db47f9ebf70ed129

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-04-05T17:15:00Z UTC

Last seen:

2026-04-22T12:58:00Z UTC

Hits:

~1000

Detections:

Trojan.Win64.Agentb.linc BSS:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/07f008e9ebfb33b2ef8a7f9dcf1f27bed1687359eb321044db47f9ebf70ed129/results?tab=lookup

Joe Sandbox Frost Stealer

Result

Threat name:

Frost Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

expl.evad.troj.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1901550

Signature

Bypasses PowerShell execution policy

Excessive usage of taskkill to terminate processes

Gathers network related connection and port information

Loading BitLocker PowerShell Module

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive system registry key value via command line tool

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Potential WinAPI Calls Via CommandLine

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Unusual module load detection (module proxying)

Uses cmd line tools excessively to alter registry or file data

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Uses netstat to query active network connections and open ports

Yara detected Frost Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

90%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/07f008e9ebfb33b2ef8a7f9dcf1f27bed1687359eb321044db47f9ebf70ed129

CERT.PL MWDB

Gathering data

Neiki Family.DOENERIUM

Verdict:

Malicious

Threat:

Family.DOENERIUM

Link:

https://tip.neiki.dev/file/07f008e9ebfb33b2ef8a7f9dcf1f27bed1687359eb321044db47f9ebf70ed129

ReversingLabs TitaniumCloud Win64.Trojan.Qwexlafiba

Threat name:

Win64.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-29 20:58:56 UTC

File Type:

PE+ (Exe)

Extracted files:

8

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a7yar2pl7mz3f34kp6o46hzhx3iwq42z5mzbarg3i746x5yo2euq._file

Hatching Triage frost_stealer

Result

Malware family:

frost_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:frost_stealer credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/260420-zsjdcafy3y/

Behaviour

Checks processor information in registry

Gathers network information

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Browser Information Discovery

Event Triggered Execution: Netsh Helper DLL

Hide Artifacts: Ignore Process Interrupts

Enumerates processes with tasklist

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Command and Scripting Interpreter: PowerShell

Family: FrostStealer

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.